> I should have explained that and specifically ask if Shibboleth > (both the SP side and the IdP side) supports that? The SP, absolutely not. The IdP supports enough extensibility to configure its attribute query support to handle a DN as a subject if it's told how to do it. -- Scott